If flush_put_bits() is called when the 32-bit buffer is empty,
e.g. after writing a multiple of 32 bits, and invalid shift by
32 is performed. Since flush_put_bits() is called infrequently,
this additional check should have negligible performance impact.
Signed-off-by: Mans Rullgard <mans@mansr.com>
* qatar/master: (24 commits)
mpegps: Use av_get_packet() instead of poorly emulating it.
motionpixels: decode only the 111 complete frames for fate
mpc8: Check out of bound bands limit
xan: Prevent NULL dereference with missing palette
xan: Check for out of bound reads in xan_huffman_decode()
xan: Fixed out of bound accesses in xan_unpack()
motionpixels: Prevent calling init_vlc() with invalid parameters
shorten: Fix out of bound writes in fix_bitshift()
dsicinav: Check for out of bounds writes
tiertexseqv: Check for out of bound reads
quickdraw: Check for out of bound reads
dsicinav: Check for out of bounds reads
motionpixels: Fix the size of workspace buffers
motionpixels: Clear FF_INPUT_BUFFER_PADDING_SIZE bytes at the end of the temporary buffer
wmavoice: Check for corrupted extra data
wmavoice: Check for out of bound writes
xan: Prevent NULL dereferences with missing reference frame
bink: Prevent NULL dereferences with missing reference frame
wavpack: Reset internal state on corrupted blocks
wmapro: Validate the number of audio channels before using it
...
Conflicts:
libavcodec/h264.c
libavcodec/xan.c
tests/ref/fate/motionpixels
Merged-by: Michael Niedermayer <michaelni@gmx.at>
wavpack_decode_block() supposes that it is called back with the exact
same buffer unless it has returned with an error. With multi-channels
files, wavpack_decode_frame() was breaking this assumption.
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
* hexene/stagefright:
libstagefright: start decode_thread() only after decode_frame() is called at least once.
libstagefright: mark the dummy frame as keyframe.
libstagefright: limit the output queue size
libstagefright: return EOS if CustomSource::read() is called after decode_thread() returns
libstagefright: set the correct frame size
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This allows concurrent decoding of the last field/frame, rather than
only the last slice, of data packets with multiple NAL units packed
together.
This will fix the slowdown reported in e.g. bug 52.
Signed-off-by: Anton Khirnov <anton@khirnov.net>
* qatar/master:
vp6: Reset the internal state when aborting key frames header parsing
vp56: Release old pictures after a resolution changes
vp6: Check for huffman tree build errors
vp56: Check for missing reference frame data
cinepak: Fix invalid read access on extra data
vmd: fix segfaults on corruped streams
cook: Fix js_vlc_bits value validation for joint stereo
segafilm: Check for memory allocation failures in segafilm demuxer.
segafilm: Fix potential division by 0 on corrupted streams in the demuxer
Fixed segfault on corrupted sega streams in the demuxer.
Fixed deference of NULL pointer in motionpixels decoder.
libx264: support 9- and 10-bit output.
h264: correct implicit_weight for field-interlaced pictures.
mpegvideo: set correct offset for edge emulation buffer.
mpegvideo: fix position of bottom edge.
Conflicts:
libavcodec/motionpixels.c
libavcodec/mpegvideo.c
libavcodec/version.h
libavcodec/vmdav.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Well, probably an ABI breakage at least for 32bit, but hopefully it will go
unnoticed because the fix happened realtively soon.
Signed-off-by: Marton Balint <cus@passwd.hu>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Michael Niedermayer
Laurent Aimar
Mans Rullgard
Alex Converse
Clément Bœsch
Maksym Veremeyenko
Janne Grunau
Laurent Aimar
Mohamed Naufal
Marton Balint